Merge branch 'v30'

src/server/ClientMsgRateLimiter.ts

@@ -3,18 +3,14 @@ import { ClientID } from "../core/Schemas";
 
 const INTENTS_PER_SECOND = 10;
 const INTENTS_PER_MINUTE = 150;
-const MAX_BYTES_PER_MINUTE = 25 * 1024; // 25KB/min per client
-const MAX_INTENT_BYTES = 500; // intents are stored in turns, keep them small
+const MAX_INTENT_SIZE = 500;
+const TOTAL_BYTES = 2 * 1024 * 1024; // 2MB per client
 export type RateLimitResult = "ok" | "limit" | "kick";
 
-// Allow 3 winner messages per client since a player can rejoin and resend.
-const MAX_WINNER_MSGS = 3;
-
 interface ClientBucket {
   perSecond: RateLimiter;
   perMinute: RateLimiter;
-  bytesPerMinute: RateLimiter;
-  winnerMsgCount: number;
+  totalBytes: number;
 }
 
 export class ClientMsgRateLimiter {
@@ -22,27 +18,27 @@ export class ClientMsgRateLimiter {
 
   check(clientID: ClientID, type: string, bytes: number): RateLimitResult {
     const bucket = this.getOrCreate(clientID);
+    bucket.totalBytes += bytes;
 
-    // Winner message contains stats for all players and can be large (100s of KB).
-    // It bypasses the byte rate limit but is strictly limited to one per client.
-    if (type === "winner") {
-      if (bucket.winnerMsgCount >= MAX_WINNER_MSGS) return "kick";
-      bucket.winnerMsgCount++;
-      return "ok";
+    if (bucket.totalBytes >= TOTAL_BYTES) return "kick";
+
+    if (type === "intent") {
+      // Intents are stored in turn history for the duration of the game, so
+      // oversized intents would accumulate and fill up server RAM.
+      // Intents are also sent to all players, so it increase outgoing
+      // data.
+      // Intents should never be larger than MAX_INTENT_SIZE, so we assume the client is malicious.
+      if (bytes > MAX_INTENT_SIZE) {
+        return "kick";
+      }
+      if (
+        !bucket.perSecond.tryRemoveTokens(1) ||
+        !bucket.perMinute.tryRemoveTokens(1)
+      ) {
+        return "limit";
+      }
     }
 
-    // Intents are stored in turn history for the duration of the game, so
-    // oversized intents would accumulate and fill up server RAM.
-    if (type === "intent" && bytes > MAX_INTENT_BYTES) return "kick";
-
-    if (!bucket.bytesPerMinute.tryRemoveTokens(bytes)) return "kick";
-
-    if (
-      !bucket.perSecond.tryRemoveTokens(1) ||
-      !bucket.perMinute.tryRemoveTokens(1)
-    )
-      return "limit";
-
     return "ok";
   }
 
@@ -60,11 +56,7 @@ export class ClientMsgRateLimiter {
         tokensPerInterval: INTENTS_PER_MINUTE,
         interval: "minute",
       }),
-      bytesPerMinute: new RateLimiter({
-        tokensPerInterval: MAX_BYTES_PER_MINUTE,
-        interval: "minute",
-      }),
-      winnerMsgCount: 0,
+      totalBytes: 0,
     };
     this.buckets.set(clientID, bucket);
     return bucket;

src/server/Worker.ts

@@ -3,6 +3,7 @@ import express, { NextFunction, Request, Response } from "express";
 import rateLimit from "express-rate-limit";
 import http from "http";
 import ipAnonymize from "ip-anonymize";
+import { RateLimiter } from "limiter";
 import path from "path";
 import { fileURLToPath } from "url";
 import { WebSocket, WebSocketServer } from "ws";
@@ -50,7 +51,7 @@ export async function startWorker() {
   const server = http.createServer(app);
   const wss = new WebSocketServer({
     noServer: true,
-    maxPayload: 2 * 1024 * 1024,
+    maxPayload: 1024 * 1024, // 1MB
   });
 
   const gm = new GameManager(config, log);
@@ -289,6 +290,11 @@ export async function startWorker() {
         : // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
           forwarded || req.socket.remoteAddress || "unknown";
 
+      if (!getWsIpLimiter(ip).tryRemoveTokens(1)) {
+        ws.close(1008, "Rate limit exceeded");
+        return;
+      }
+
       try {
         // Parse and handle client messages
         const parsed = ClientMessageSchema.safeParse(
@@ -610,3 +616,21 @@ function generateGameIdForWorker(): GameID | null {
   log.warn(`Failed to generate game ID for worker ${workerId}`);
   return null;
 }
+
+// Per-IP rate limiter for pre-join WebSocket messages.
+// Prevents unauthenticated connections from spamming messages
+// (e.g. pings) before joining a game.
+const wsIpLimiters = new Map<string, RateLimiter>();
+function getWsIpLimiter(ip: string): RateLimiter {
+  let limiter = wsIpLimiters.get(ip);
+  if (!limiter) {
+    limiter = new RateLimiter({
+      tokensPerInterval: 5,
+      interval: "second",
+    });
+    wsIpLimiters.set(ip, limiter);
+  }
+  return limiter;
+}
+// Clean up stale IP limiters every 10 minutes
+setInterval(() => wsIpLimiters.clear(), 10 * 60 * 1000);